Director, Post-Breach Recovery & IR Leadership

Cypfer; United States; On-site; USD 180,000 - 260,000; Full time

Job summary

CYPFER is seeking an experienced Director, Cybersecurity - Post Breach Recovery/IR to lead complex post-breach remediation and ransomware recovery engagements. This role combines strategic leadership with hands-on technical guidance as incidents unfold.

You will direct teams rebuilding compromised infrastructure and identity platforms, design secure rebuild strategies, and communicate with executives, legal teams, and technical stakeholders.

Qualifications

• 8+ years in cybersecurity, incident response, or enterprise infrastructure.
• Strong technical background in enterprise systems and identity architecture.
• Experience with Active Directory recovery and identity security.
• Hands-on familiarity with EDR, containment strategies, and remediation workflows.
• Experience leading technical teams during major cyber incident.
• Ability to operate both strategically and hands-on when needed.

Responsibilities

• Lead technical recovery efforts during major cyber incidents.
• Direct teams rebuilding compromised infrastructure and identity platforms.
• Serve as a senior technical resource for complex recovery challenges.
• Guide containment, eradication, and recovery operations.
• Help design and execute secure rebuild strategies for enterprise environments.
• Communicate clearly with executives, legal teams, and technical stakeholders.
• Mentor and support consultants across multiple engagements.
• Contribute to the development of recovery playbooks and frameworks.

Skills

Cybersecurity

Incident Response

Identity Architecture

Active Directory

EDR

Leadership

Hybrid Identity

Job description

CYPFER is seeking an experienced Director, Cybersecurity - Post Breach Recovery/IR to lead complex post-breach remediation and ransomware recovery engagements. This role combines strategic leadership with hands-on technical guidance as incidents unfold.

You will direct teams rebuilding compromised infrastructure and identity platforms, design secure rebuild strategies, and communicate with executives, legal teams, and technical stakeholders.